The web administration panel of the Acer Connect M6E 5G Portable WiFi Router listens on the entire public IPv6 address space on port 8080 without any default firewall restrictions, exposing internal API endpoints to the WAN. An attacker who can reach the device’s IPv6 address can access these APIs without authentication, potentially enabling configuration changes, data exfiltration, or further compromise of the network device. This represents a moderate severity vulnerability that could be leveraged for unauthorized remote management.

Acer Connect M6E 5G Portable WiFi Router is affected. Specific firmware or version information is not provided in the available data, so all released firmware releases that include the default IPv6 binding behavior are potentially vulnerable.

The CVSS score of 6.9 indicates moderate impact and the lack of an available EPSS score or KEV listing suggests limited known exploitation, but the lack of firewall barriers makes the vulnerability potentially exploitable by anyone who can route traffic to the device’s IPv6 address on port 8080. An attacker would leverage the broad IPv6 binding to access internal administrative APIs, exploiting the CWE-200 weakness of information exposure. The risk is heightened if the device is exposed behind a public IP without additional network isolation.